Three frameworks, one required by a regulator and two by major customers, each impose separate audits on the same operational teams, causing duplicate evidence requests and audit fatigue. What is the BEST approach?
Select an answer to reveal the explanation.
Short Explanation
Three rulebooks often ask for the same thing in different words. Map them onto a single set of controls, test each control once, and reuse the evidence for every audit. You can't just drop a framework that a regulator or customer requires, and that's the trap here.
Full Explanation
When multiple frameworks overlap, many requirements address the same underlying control objectives in different language. Mapping the requirements of all applicable frameworks to a unified control set allows each control to be designed, operated and tested once, with evidence collected once and reused for each framework's assessment. This reduces duplicate requests, lowers cost and gives management a single view of control status, while any framework-specific requirements remain visible as additions to the common set. Dropping two frameworks is not an option when they are required by customers; doing so risks losing business or breaching contracts, and the most comprehensive framework may still not satisfy the others' specific terms. Assigning a separate compliance team to each framework institutionalizes the duplication and increases cost rather than reducing it. Reducing audit frequency is usually not within the organization's control when the audits are required by a regulator or customer contracts, and stretching intervals may breach those terms. Exam caveat: mapping does not guarantee acceptance; each regulator or customer may still require its own report, but the underlying testing and evidence can be shared. Operational check: maintain a control matrix showing each unified control and the framework requirements it satisfies, and measure duplicate evidence requests over time.